amadey | 24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe
Size

1.1MB
MD5

b53239843746092c9ec6807c4dd64e19
SHA1

704427a61e605f8dd66023f5e0fc47a6366204e4
SHA256

24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e
SHA512

83fffca3b79d2763497d60f22c9e1c5e7df03c0fb9e578840450fc404d93b4be7b02891037d9eb71174baf50a4d30ba902ba32cd2a2230c366f8d16b128accd3
SSDEEP

24576:cyrWsQRhUmUGq0TxMsiMaqWGqp/ySvZcyW6xB9SNjz4meQaJMw:Le3UmUGvxH/d2yS6r6x/6jz5GM

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3652-28-0x0000000002170000-0x000000000218A000-memory.dmp	healer
behavioral1/memory/3652-30-0x0000000004970000-0x0000000004988000-memory.dmp	healer
behavioral1/memory/3652-56-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-58-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-54-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-42-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-40-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-38-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-36-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-34-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-32-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-31-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-52-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-50-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-48-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-46-0x0000000004970000-0x0000000004983000-memory.dmp	healer
behavioral1/memory/3652-44-0x0000000004970000-0x0000000004983000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	272594870.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	272594870.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	272594870.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	272594870.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	272594870.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	138592336.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2560-112-0x0000000007150000-0x000000000718C000-memory.dmp	family_redline
behavioral1/memory/2560-113-0x00000000071D0000-0x000000000720A000-memory.dmp	family_redline
behavioral1/memory/2560-119-0x00000000071D0000-0x0000000007205000-memory.dmp	family_redline
behavioral1/memory/2560-117-0x00000000071D0000-0x0000000007205000-memory.dmp	family_redline
behavioral1/memory/2560-115-0x00000000071D0000-0x0000000007205000-memory.dmp	family_redline
behavioral1/memory/2560-114-0x00000000071D0000-0x0000000007205000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	303992721.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
380	oG668554.exe
5092	Pk471392.exe
1800	Kw422938.exe
3652	138592336.exe
5028	272594870.exe
2092	303992721.exe
1968	oneetx.exe
2560	445751020.exe
5352	oneetx.exe
6116	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	138592336.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	272594870.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	oG668554.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Pk471392.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Kw422938.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	5028	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272594870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	303992721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	445751020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oG668554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pk471392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kw422938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	138592336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3652	138592336.exe
3652	138592336.exe
5028	272594870.exe
5028	272594870.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	138592336.exe
Token: SeDebugPrivilege	5028	272594870.exe
Token: SeDebugPrivilege	2560	445751020.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	303992721.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 380	3344	24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe	84
PID 3344 wrote to memory of 380	3344	24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe	84
PID 3344 wrote to memory of 380	3344	24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe	84
PID 380 wrote to memory of 5092	380	oG668554.exe	85
PID 380 wrote to memory of 5092	380	oG668554.exe	85
PID 380 wrote to memory of 5092	380	oG668554.exe	85
PID 5092 wrote to memory of 1800	5092	Pk471392.exe	86
PID 5092 wrote to memory of 1800	5092	Pk471392.exe	86
PID 5092 wrote to memory of 1800	5092	Pk471392.exe	86
PID 1800 wrote to memory of 3652	1800	Kw422938.exe	87
PID 1800 wrote to memory of 3652	1800	Kw422938.exe	87
PID 1800 wrote to memory of 3652	1800	Kw422938.exe	87
PID 1800 wrote to memory of 5028	1800	Kw422938.exe	96
PID 1800 wrote to memory of 5028	1800	Kw422938.exe	96
PID 1800 wrote to memory of 5028	1800	Kw422938.exe	96
PID 5092 wrote to memory of 2092	5092	Pk471392.exe	100
PID 5092 wrote to memory of 2092	5092	Pk471392.exe	100
PID 5092 wrote to memory of 2092	5092	Pk471392.exe	100
PID 2092 wrote to memory of 1968	2092	303992721.exe	101
PID 2092 wrote to memory of 1968	2092	303992721.exe	101
PID 2092 wrote to memory of 1968	2092	303992721.exe	101
PID 380 wrote to memory of 2560	380	oG668554.exe	102
PID 380 wrote to memory of 2560	380	oG668554.exe	102
PID 380 wrote to memory of 2560	380	oG668554.exe	102
PID 1968 wrote to memory of 5016	1968	oneetx.exe	103
PID 1968 wrote to memory of 5016	1968	oneetx.exe	103
PID 1968 wrote to memory of 5016	1968	oneetx.exe	103
PID 1968 wrote to memory of 3508	1968	oneetx.exe	105
PID 1968 wrote to memory of 3508	1968	oneetx.exe	105
PID 1968 wrote to memory of 3508	1968	oneetx.exe	105
PID 3508 wrote to memory of 4892	3508	cmd.exe	107
PID 3508 wrote to memory of 4892	3508	cmd.exe	107
PID 3508 wrote to memory of 4892	3508	cmd.exe	107
PID 3508 wrote to memory of 3032	3508	cmd.exe	108
PID 3508 wrote to memory of 3032	3508	cmd.exe	108
PID 3508 wrote to memory of 3032	3508	cmd.exe	108
PID 3508 wrote to memory of 1208	3508	cmd.exe	109
PID 3508 wrote to memory of 1208	3508	cmd.exe	109
PID 3508 wrote to memory of 1208	3508	cmd.exe	109
PID 3508 wrote to memory of 4532	3508	cmd.exe	110
PID 3508 wrote to memory of 4532	3508	cmd.exe	110
PID 3508 wrote to memory of 4532	3508	cmd.exe	110
PID 3508 wrote to memory of 3888	3508	cmd.exe	111
PID 3508 wrote to memory of 3888	3508	cmd.exe	111
PID 3508 wrote to memory of 3888	3508	cmd.exe	111
PID 3508 wrote to memory of 1536	3508	cmd.exe	112
PID 3508 wrote to memory of 1536	3508	cmd.exe	112
PID 3508 wrote to memory of 1536	3508	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe
"C:\Users\Admin\AppData\Local\Temp\24d2a872d5eda59c356193f1e84726a6278b1d838622a4bdd9678de622dcba2e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oG668554.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oG668554.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pk471392.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pk471392.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kw422938.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kw422938.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\138592336.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\138592336.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\272594870.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\272594870.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1084
        6⤵
        Program crash
        
        PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\303992721.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\303992721.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1968
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5016
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\445751020.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\445751020.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5028 -ip 5028
1⤵
PID:3972

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5352

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:6116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oG668554.exe

Filesize
931KB

MD5
5e47f4341ad8d237b30e03e2907b5c94

SHA1
830cf0d2c84cdc14e1a7f5cbb598f3b5b61ce718

SHA256
a866ff826f4435017cfb4dda6151a75a00b6cd350b50c77be26bf963fc59eee2

SHA512
be86aa7355508c27a97d1681a432ea95170550d3e107d11c1b98f71369fc054cdab953071d1372c2e0c3247168c64a604b525f8fde5e404acea056e62b5ce5c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\445751020.exe

Filesize
348KB

MD5
798f3b41c350737b19e9ea2a83ae1946

SHA1
a1c99b681b280cb6fd441ce5057567270a4e8d0f

SHA256
3df0f6a00de79935615120d5e70f60357981d9f5ad5bbdbca722f26e88962d08

SHA512
14db41922a4135419999f0664e2a93f3dc49369d4be11f5f1fe43e9dae1517a477c63b1a7af0ac37daf293eea487282dda2fe16f0a5f7f232e4d244b8b143a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pk471392.exe

Filesize
577KB

MD5
6b318d389408b2e2f7cfea4aea44423c

SHA1
562d2f6f4737cb7628d71629c77eb21d6e19b7a3

SHA256
46f3a3f5f606283bd656e6d47beefd2893d3ec7a4aadfb6e865b02470fd91396

SHA512
d6f6e535f1128d919ecd249481b189658bb044b383e7232c08c908bf2cbe11a17cc905cf329710c9a6d31883a0b2e1ce16eb4b613b013ef242f8c67ac62c87b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\303992721.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kw422938.exe

Filesize
406KB

MD5
9b40d6d3da598807df43a12f723735f6

SHA1
9368c9643ac692485220a5b90b977bad892dfc85

SHA256
f50655700e710d92ab869e20958fddd901f7e3146e518f2c9d3416775c9f2b7f

SHA512
e12de08abbcdedcf49a0542d041350bb271dc2d0dfb9a58afb99d3909d7df51dd44376563d9c51a7b91a42afd1986be05fd3e768e4ad29f7dc4e052c3ee437c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\138592336.exe

Filesize
175KB

MD5
3d10b67208452d7a91d7bd7066067676

SHA1
e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

SHA256
5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

SHA512
b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\272594870.exe

Filesize
264KB

MD5
f7450a32a806a53c2f46e622ec434a1d

SHA1
598c0dd97535efba28326ab80a8f16063e609bd9

SHA256
ab98f26b438913ee2eb4187efcedfe27d8359497fc70bfb2f92c1d7f40ed92f1

SHA512
456feede39c8f1e1026c90426d35d4085418aab33b9da3eaa833cda17a57c988fa819aa82717f6d6a4432bec5f696fe191ec26868c1c1fd35285832736818f92

Download Submit
memory/2560-906-0x0000000009C90000-0x000000000A2A8000-memory.dmp

Filesize
6.1MB

Download
memory/2560-907-0x000000000A330000-0x000000000A342000-memory.dmp

Filesize
72KB

Download
memory/2560-908-0x000000000A350000-0x000000000A45A000-memory.dmp

Filesize
1.0MB

Download
memory/2560-114-0x00000000071D0000-0x0000000007205000-memory.dmp

Filesize
212KB

Download
memory/2560-115-0x00000000071D0000-0x0000000007205000-memory.dmp

Filesize
212KB

Download
memory/2560-117-0x00000000071D0000-0x0000000007205000-memory.dmp

Filesize
212KB

Download
memory/2560-119-0x00000000071D0000-0x0000000007205000-memory.dmp

Filesize
212KB

Download
memory/2560-113-0x00000000071D0000-0x000000000720A000-memory.dmp

Filesize
232KB

Download
memory/2560-112-0x0000000007150000-0x000000000718C000-memory.dmp

Filesize
240KB

Download
memory/2560-909-0x000000000A470000-0x000000000A4AC000-memory.dmp

Filesize
240KB

Download
memory/2560-910-0x0000000004C40000-0x0000000004C8C000-memory.dmp

Filesize
304KB

Download
memory/3652-54-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-40-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-46-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-44-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-50-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-28-0x0000000002170000-0x000000000218A000-memory.dmp

Filesize
104KB

Download
memory/3652-52-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-29-0x0000000004AC0000-0x0000000005064000-memory.dmp

Filesize
5.6MB

Download
memory/3652-31-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-32-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-34-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-36-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-38-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-48-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-42-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-58-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-56-0x0000000004970000-0x0000000004983000-memory.dmp

Filesize
76KB

Download
memory/3652-30-0x0000000004970000-0x0000000004988000-memory.dmp

Filesize
96KB

Download
memory/5028-94-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/5028-92-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download