amadey | dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe
Size

1.0MB
MD5

abb94ac801105b64ce0e2a2185b2344b
SHA1

a80698d0647d9e625d1d8d2e2fcbb19f9f82158a
SHA256

dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d
SHA512

302ef92bc34ed6bc09ad577fd424507e1235f73cfbae34b01d598d7fdeedb80a276daad8b81eaf9ae698711b745e5b71127efb63dedd5b9bc7dd34342da853bb
SSDEEP

24576:2ylAvVuDBTZIF7XjghkT37omKfUT2zSJnryPJ5ve4tYc:F6vkZIF7skXSx2Jnsny

Score

10^/10

amadey healer redline b50502 rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.70

Botnet

b50502

http://77.91.124.207

Attributes

install_dir
595f021478
install_file
oneetx.exe
strings_key
6e3d32d239380a49b6f83128fe71ea01
url_paths
/plays/chapter/index.php

rc4.plain

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az771125.exe	healer
behavioral1/memory/1704-28-0x00000000008D0000-0x00000000008DA000-memory.dmp	healer
behavioral1/memory/4880-53-0x00000000024C0000-0x00000000024DA000-memory.dmp	healer
behavioral1/memory/4880-55-0x0000000004B80000-0x0000000004B98000-memory.dmp	healer
behavioral1/memory/4880-61-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-83-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-81-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-79-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-77-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-75-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-73-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-72-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-69-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-67-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-65-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-63-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-57-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-56-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/4880-59-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

az771125.execor8794.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az771125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az771125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az771125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az771125.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor8794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor8794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor8794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor8794.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az771125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az771125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor8794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor8794.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5036-92-0x0000000002470000-0x00000000024B6000-memory.dmp	family_redline
behavioral1/memory/5036-93-0x0000000005090000-0x00000000050D4000-memory.dmp	family_redline
behavioral1/memory/5036-99-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-109-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-126-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-123-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-121-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-119-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-117-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-115-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-111-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-107-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-105-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-103-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-101-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-113-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-97-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-95-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/5036-94-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bu835791.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	bu835791.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

Processes:

kina5146.exekina4208.exekina5734.exeaz771125.exebu835791.exeoneetx.execor8794.exeddn48s00.exeoneetx.exeoneetx.exe

pid	process
2016	kina5146.exe
3920	kina4208.exe
1080	kina5734.exe
1704	az771125.exe
1540	bu835791.exe
4992	oneetx.exe
4880	cor8794.exe
5036	ddn48s00.exe
5312	oneetx.exe
6120	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

cor8794.exeaz771125.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor8794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor8794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az771125.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exekina5146.exekina4208.exekina5734.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina5146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina4208.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina5734.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2200	1540	WerFault.exe	bu835791.exe
1124	1540	WerFault.exe	bu835791.exe
1456	1540	WerFault.exe	bu835791.exe
3720	1540	WerFault.exe	bu835791.exe
2932	1540	WerFault.exe	bu835791.exe
4268	1540	WerFault.exe	bu835791.exe
3024	1540	WerFault.exe	bu835791.exe
1060	1540	WerFault.exe	bu835791.exe
4360	1540	WerFault.exe	bu835791.exe
1144	1540	WerFault.exe	bu835791.exe
1400	4992	WerFault.exe	oneetx.exe
3336	1540	WerFault.exe	bu835791.exe
4060	4992	WerFault.exe	oneetx.exe
1592	4992	WerFault.exe	oneetx.exe
3660	4992	WerFault.exe	oneetx.exe
1908	4992	WerFault.exe	oneetx.exe
3152	4992	WerFault.exe	oneetx.exe
904	4992	WerFault.exe	oneetx.exe
3308	4992	WerFault.exe	oneetx.exe
364	4992	WerFault.exe	oneetx.exe
1512	4992	WerFault.exe	oneetx.exe
4584	4992	WerFault.exe	oneetx.exe
4820	4992	WerFault.exe	oneetx.exe
3268	4880	WerFault.exe	cor8794.exe
5280	4992	WerFault.exe	oneetx.exe
2028	5312	WerFault.exe	oneetx.exe
6032	6120	WerFault.exe	oneetx.exe
1456	4992	WerFault.exe	oneetx.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exekina5146.exeoneetx.execor8794.exebu835791.exeddn48s00.exedc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exekina4208.exekina5734.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina5146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cor8794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bu835791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddn48s00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina4208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina5734.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3360 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

az771125.execor8794.exe

pid process

1704 az771125.exe
1704 az771125.exe
4880 cor8794.exe
4880 cor8794.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

az771125.execor8794.exeddn48s00.exe

description pid process

Token: SeDebugPrivilege 1704 az771125.exe
Token: SeDebugPrivilege 4880 cor8794.exe
Token: SeDebugPrivilege 5036 ddn48s00.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

bu835791.exe

pid process

1540 bu835791.exe

pid	process
3360	schtasks.exe

pid	process
1704	az771125.exe
1704	az771125.exe
4880	cor8794.exe
4880	cor8794.exe

description	pid	process
Token: SeDebugPrivilege	1704	az771125.exe
Token: SeDebugPrivilege	4880	cor8794.exe
Token: SeDebugPrivilege	5036	ddn48s00.exe

pid	process
1540	bu835791.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exekina5146.exekina4208.exekina5734.exebu835791.exeoneetx.exe

description	pid	process	target process
PID 4452 wrote to memory of 2016	4452	dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe	kina5146.exe
PID 4452 wrote to memory of 2016	4452	dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe	kina5146.exe
PID 4452 wrote to memory of 2016	4452	dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe	kina5146.exe
PID 2016 wrote to memory of 3920	2016	kina5146.exe	kina4208.exe
PID 2016 wrote to memory of 3920	2016	kina5146.exe	kina4208.exe
PID 2016 wrote to memory of 3920	2016	kina5146.exe	kina4208.exe
PID 3920 wrote to memory of 1080	3920	kina4208.exe	kina5734.exe
PID 3920 wrote to memory of 1080	3920	kina4208.exe	kina5734.exe
PID 3920 wrote to memory of 1080	3920	kina4208.exe	kina5734.exe
PID 1080 wrote to memory of 1704	1080	kina5734.exe	az771125.exe
PID 1080 wrote to memory of 1704	1080	kina5734.exe	az771125.exe
PID 1080 wrote to memory of 1540	1080	kina5734.exe	bu835791.exe
PID 1080 wrote to memory of 1540	1080	kina5734.exe	bu835791.exe
PID 1080 wrote to memory of 1540	1080	kina5734.exe	bu835791.exe
PID 1540 wrote to memory of 4992	1540	bu835791.exe	oneetx.exe
PID 1540 wrote to memory of 4992	1540	bu835791.exe	oneetx.exe
PID 1540 wrote to memory of 4992	1540	bu835791.exe	oneetx.exe
PID 3920 wrote to memory of 4880	3920	kina4208.exe	cor8794.exe
PID 3920 wrote to memory of 4880	3920	kina4208.exe	cor8794.exe
PID 3920 wrote to memory of 4880	3920	kina4208.exe	cor8794.exe
PID 4992 wrote to memory of 3360	4992	oneetx.exe	schtasks.exe
PID 4992 wrote to memory of 3360	4992	oneetx.exe	schtasks.exe
PID 4992 wrote to memory of 3360	4992	oneetx.exe	schtasks.exe
PID 2016 wrote to memory of 5036	2016	kina5146.exe	ddn48s00.exe
PID 2016 wrote to memory of 5036	2016	kina5146.exe	ddn48s00.exe
PID 2016 wrote to memory of 5036	2016	kina5146.exe	ddn48s00.exe

C:\Users\Admin\AppData\Local\Temp\dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe
"C:\Users\Admin\AppData\Local\Temp\dc74708df8924525b2e8b97f7402243a71ad8fb11abea3a3447690cbf556299d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5146.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5146.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4208.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4208.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5734.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5734.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az771125.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az771125.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu835791.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu835791.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 704
6⤵
- Program crash
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 764
6⤵
- Program crash
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 856
6⤵
- Program crash
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 972
6⤵
- Program crash
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 984
6⤵
- Program crash
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 948
6⤵
- Program crash
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1204
6⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1224
6⤵
- Program crash
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1312
6⤵
- Program crash
PID:4360

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 692
7⤵
- Program crash
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1004
7⤵
- Program crash
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1072
7⤵
- Program crash
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1080
7⤵
- Program crash
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1112
7⤵
- Program crash
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1004
7⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1120
7⤵
- Program crash
PID:904

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 992
7⤵
- Program crash
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
7⤵
- Program crash
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 768
7⤵
- Program crash
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 988
7⤵
- Program crash
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1436
7⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1080
7⤵
- Program crash
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1416
7⤵
- Program crash
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1716
6⤵
- Program crash
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 756
6⤵
- Program crash
PID:3336

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8794.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8794.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1080
5⤵
- Program crash
PID:3268

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ddn48s00.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ddn48s00.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 1540
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1540 -ip 1540
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1540 -ip 1540
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1540 -ip 1540
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1540 -ip 1540
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1540 -ip 1540
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1540 -ip 1540
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1540 -ip 1540
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1540 -ip 1540
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1540 -ip 1540
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4992 -ip 4992
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1540 -ip 1540
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4992 -ip 4992
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4992 -ip 4992
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4992 -ip 4992
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4992 -ip 4992
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4992 -ip 4992
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4880 -ip 4880
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4992 -ip 4992
1⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 216
2⤵
- Program crash
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5312 -ip 5312
1⤵
PID:4676

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 312
2⤵
- Program crash
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6120 -ip 6120
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4992 -ip 4992
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5146.exe

Filesize
920KB

MD5
7225da0080072d0b025fefd5e8a8db7b

SHA1
73c9eefc3597f171ff7a0f1870f46f694bab8de2

SHA256
0d1f9534a931f37c02622cb4dce0fc3d88956df5d246a001ff317faddf94e0ca

SHA512
70fedf95c7b0ad1dc20e35d8f362d2dab48e89b95e1a708ca6b7c511324428309fd9e7a69de99e70dd40d26040fe86fc8516ca0a5fb49860cc5ba0b26604c0aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ddn48s00.exe

Filesize
298KB

MD5
1b496161177a197f08c50a9422684a41

SHA1
7c319d557994dea0b4b16fa4f12db9081f722957

SHA256
4e6af3e52fc63d3d4aa297d9e42cc73775f444d3c6cc22cd28f954f568b7712f

SHA512
2c2e52b379d1713932b3a306dd3092a20cb104eaf0d18a238f59262ce496ca13b3a263b6ff502596cd2d164d1fb5f29411a369b7e27a3be5086172d7b2ccfdc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4208.exe

Filesize
588KB

MD5
b320beb0120847b5b435d5f943b5abcb

SHA1
0caaaa348a0b2dadf84593cab25222fded589d14

SHA256
72c2e53a1325b7487e3cf9e4d2e361aac8b241be02f06017c86f9b2767a154f7

SHA512
9d5fc261653e52b3a91679f4544c3a2c30ae391a903d3eec64512107d1d639ea8e642946c39ede2df473332cc6f1c48ee91553b3efa504186fa7c6f84b34b63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8794.exe

Filesize
239KB

MD5
d7334a72cf45d92f59388d5c8d4e52a2

SHA1
b476064a6c29157b08f5e6e1dda598c6cbaa556f

SHA256
236ef03f394f50034e40dd2274c53b6f97946b6d43ee6d49e819a183b2e5f23a

SHA512
cdfded6b86989ec455f111549dd6e9adddd263557a6b08728928cc4d0ae956c6a7e6531b7f91f0428ed166d7afd3063d7b64b4fef94ba65bca49e3c94cfcd65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5734.exe

Filesize
315KB

MD5
62a3c3439c5de1bfedf62b39b215a0a2

SHA1
e2aa4c014f8c4af80ec72e83c593fdc136577665

SHA256
930bd058bd2700ab3d33819bc2980f81bb7dfb23d8b670a81d9bc9ffd0a726a3

SHA512
c5b1708ca46e87fd8a47dc16184f81fe1a3ed1a6fb45b4b00b9088126b29f783cc5fc4140e6ed2ff6ab5c38d95530ffce1c0ccf594566a55d288506f3b904c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az771125.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu835791.exe

Filesize
231KB

MD5
27d46213f24b50b85930d758e983dcbd

SHA1
f2271208cbc2a0fa43bb26c7ebcf1775b10ee53a

SHA256
7bb18f7c0b2597b3f9b0359894960deafb4ddf0f4f71c03ad88d7ca2742ffeff

SHA512
61ede5ede75f1d84d63731f13ab0477c09e710fcf6e1868b5a671d4f600bcdf13d824f1078abebf443b18ccbb19aebed603373fe6d8c42f0dcc2b0d65e4a5128

Download Submit
memory/1540-48-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1704-28-0x00000000008D0000-0x00000000008DA000-memory.dmp

Filesize
40KB

Download
memory/4880-85-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4880-67-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-61-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-83-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-81-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-79-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-77-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-75-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-73-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-72-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-69-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-55-0x0000000004B80000-0x0000000004B98000-memory.dmp

Filesize
96KB

Download
memory/4880-65-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-63-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-57-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-56-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-59-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4880-53-0x00000000024C0000-0x00000000024DA000-memory.dmp

Filesize
104KB

Download
memory/4880-54-0x0000000004D00000-0x00000000052A4000-memory.dmp

Filesize
5.6MB

Download
memory/4880-87-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4992-84-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/5036-99-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-107-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-92-0x0000000002470000-0x00000000024B6000-memory.dmp

Filesize
280KB

Download
memory/5036-109-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-126-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-123-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-121-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-119-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-117-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-115-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-111-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-93-0x0000000005090000-0x00000000050D4000-memory.dmp

Filesize
272KB

Download
memory/5036-105-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-103-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-101-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-113-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-97-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-95-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-94-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/5036-1000-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/5036-1001-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/5036-1002-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/5036-1003-0x0000000005930000-0x000000000596C000-memory.dmp

Filesize
240KB

Download
memory/5036-1004-0x0000000005A70000-0x0000000005ABC000-memory.dmp

Filesize
304KB

Download