amadey | 73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe
Size 1.6MB
Sample241109-gm44raygrc
SHA256 73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7
MD5 db5ab02114390994a88019d23f40d07c
SHA1 fa8d8869bc585c364d2591bafbb6f3ba7a30795a
SHA512 ea3d5759e470f197ce6a4296d920cc7049f513a79c6579a87b0b3fc8d6c9ac504e8b9adc9772bf8eadaff9721905174af8daa7a4492dd5e5441954577d0306bb
SSDEEP 49152:3KPcuAHuOApFtk2QP7g0vT0uXHfQ1LK46:pHRALtkZzgbcqm4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey healer redline 9c0adb gena most discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 5 IoCs

resource	yara_rule
behavioral1/memory/3464-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp	healer
behavioral1/files/0x000e000000023a77-2171.dat	healer
behavioral1/memory/6276-2181-0x00000000004D0000-0x00000000004DA000-memory.dmp	healer
behavioral1/memory/6304-2184-0x00000000023A0000-0x00000000023BA000-memory.dmp	healer
behavioral1/memory/6304-2185-0x0000000002690000-0x00000000026A8000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b25092743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	b25092743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b25092743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b25092743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b25092743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b25092743.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/7096-4383-0x0000000005770000-0x00000000057A2000-memory.dmp	family_redline
behavioral1/files/0x000e000000023a77-4388.dat	family_redline
behavioral1/memory/5228-4396-0x00000000001B0000-0x00000000001DE000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b84-4403.dat	family_redline
behavioral1/memory/6708-4407-0x00000000009B0000-0x00000000009E0000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	a72581543.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	c17816032.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	d13355996.exe

Executes dropped EXE 14 IoCs

pid	Process
2380	nU327205.exe
3492	fS298353.exe
4988	yP168367.exe
5060	ds517465.exe
3464	a72581543.exe
6276	1.exe
6304	b25092743.exe
6964	c17816032.exe
7060	oneetx.exe
7096	d13355996.exe
5228	1.exe
6708	f50923643.exe
1536	oneetx.exe
4904	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	b25092743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	b25092743.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	fS298353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	yP168367.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	ds517465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nU327205.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6912	6304	WerFault.exe	92
6392	7096	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c17816032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a72581543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b25092743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d13355996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yP168367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ds517465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f50923643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nU327205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fS298353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6276	1.exe
6276	1.exe
6304	b25092743.exe
6304	b25092743.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	a72581543.exe
Token: SeDebugPrivilege	6304	b25092743.exe
Token: SeDebugPrivilege	6276	1.exe
Token: SeDebugPrivilege	7096	d13355996.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6964	c17816032.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2380	2200	73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe	83
PID 2200 wrote to memory of 2380	2200	73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe	83
PID 2200 wrote to memory of 2380	2200	73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe	83
PID 2380 wrote to memory of 3492	2380	nU327205.exe	84
PID 2380 wrote to memory of 3492	2380	nU327205.exe	84
PID 2380 wrote to memory of 3492	2380	nU327205.exe	84
PID 3492 wrote to memory of 4988	3492	fS298353.exe	85
PID 3492 wrote to memory of 4988	3492	fS298353.exe	85
PID 3492 wrote to memory of 4988	3492	fS298353.exe	85
PID 4988 wrote to memory of 5060	4988	yP168367.exe	87
PID 4988 wrote to memory of 5060	4988	yP168367.exe	87
PID 4988 wrote to memory of 5060	4988	yP168367.exe	87
PID 5060 wrote to memory of 3464	5060	ds517465.exe	88
PID 5060 wrote to memory of 3464	5060	ds517465.exe	88
PID 5060 wrote to memory of 3464	5060	ds517465.exe	88
PID 3464 wrote to memory of 6276	3464	a72581543.exe	91
PID 3464 wrote to memory of 6276	3464	a72581543.exe	91
PID 5060 wrote to memory of 6304	5060	ds517465.exe	92
PID 5060 wrote to memory of 6304	5060	ds517465.exe	92
PID 5060 wrote to memory of 6304	5060	ds517465.exe	92
PID 4988 wrote to memory of 6964	4988	yP168367.exe	101
PID 4988 wrote to memory of 6964	4988	yP168367.exe	101
PID 4988 wrote to memory of 6964	4988	yP168367.exe	101
PID 6964 wrote to memory of 7060	6964	c17816032.exe	102
PID 6964 wrote to memory of 7060	6964	c17816032.exe	102
PID 6964 wrote to memory of 7060	6964	c17816032.exe	102
PID 3492 wrote to memory of 7096	3492	fS298353.exe	103
PID 3492 wrote to memory of 7096	3492	fS298353.exe	103
PID 3492 wrote to memory of 7096	3492	fS298353.exe	103
PID 7060 wrote to memory of 7144	7060	oneetx.exe	104
PID 7060 wrote to memory of 7144	7060	oneetx.exe	104
PID 7060 wrote to memory of 7144	7060	oneetx.exe	104
PID 7060 wrote to memory of 7156	7060	oneetx.exe	105
PID 7060 wrote to memory of 7156	7060	oneetx.exe	105
PID 7060 wrote to memory of 7156	7060	oneetx.exe	105
PID 7156 wrote to memory of 5564	7156	cmd.exe	108
PID 7156 wrote to memory of 5564	7156	cmd.exe	108
PID 7156 wrote to memory of 5564	7156	cmd.exe	108
PID 7156 wrote to memory of 5608	7156	cmd.exe	109
PID 7156 wrote to memory of 5608	7156	cmd.exe	109
PID 7156 wrote to memory of 5608	7156	cmd.exe	109
PID 7156 wrote to memory of 5696	7156	cmd.exe	110
PID 7156 wrote to memory of 5696	7156	cmd.exe	110
PID 7156 wrote to memory of 5696	7156	cmd.exe	110
PID 7156 wrote to memory of 5744	7156	cmd.exe	111
PID 7156 wrote to memory of 5744	7156	cmd.exe	111
PID 7156 wrote to memory of 5744	7156	cmd.exe	111
PID 7156 wrote to memory of 5784	7156	cmd.exe	112
PID 7156 wrote to memory of 5784	7156	cmd.exe	112
PID 7156 wrote to memory of 5784	7156	cmd.exe	112
PID 7156 wrote to memory of 5904	7156	cmd.exe	113
PID 7156 wrote to memory of 5904	7156	cmd.exe	113
PID 7156 wrote to memory of 5904	7156	cmd.exe	113
PID 7096 wrote to memory of 5228	7096	d13355996.exe	114
PID 7096 wrote to memory of 5228	7096	d13355996.exe	114
PID 7096 wrote to memory of 5228	7096	d13355996.exe	114
PID 2380 wrote to memory of 6708	2380	nU327205.exe	117
PID 2380 wrote to memory of 6708	2380	nU327205.exe	117
PID 2380 wrote to memory of 6708	2380	nU327205.exe	117

C:\Users\Admin\AppData\Local\Temp\73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe
"C:\Users\Admin\AppData\Local\Temp\73dfc691e9a142252975d4cf48aa4079462b6e6041681b5d2ab0e25bb4f679a7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nU327205.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nU327205.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fS298353.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fS298353.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yP168367.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yP168367.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ds517465.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ds517465.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a72581543.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a72581543.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b25092743.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b25092743.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6304 -s 1092
        7⤵
        Program crash
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c17816032.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c17816032.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:7060
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:7144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:7156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d13355996.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d13355996.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:7096
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1520
        5⤵
        Program crash
        
        PID:6392
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f50923643.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f50923643.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6304 -ip 6304
1⤵
PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7096 -ip 7096
1⤵
PID:5276

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1536

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nU327205.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nU327205.exe
Size 1.3MB
SHA256 cfc1704c4b18035e9adecacf0f97ce3649f8b4ce71a1dd61c94088ff3dd5263d
MD5 703748e2bf526cdcb86f7a53a390be22
SHA1 ad45ab805e29bc9035a96ced7ef6d895f6c75611
SHA512 f85a9def661f99dcf7b7325a282f533e0dade78b0985ebc5a9bee187467d7b1b3bc9777d0fecae32d4e035fb9140824892c716741510b42d5b58a22ece7c1774
SSDEEP 24576:+yCJA2rm7hJkjGBN/yVIx8stpExbQzFfd0UE0u/emojI1UUIFsoP4VX1Fc:NC+bgENa+x9t2FQzhd0UE0u/COoAL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f50923643.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f50923643.exe
Size 169KB
SHA256 a989cb835da8e54f112b723d92bab675ccc5e998c6820494ece40ede01a2fa42
MD5 a63e8aa05b9ffa59e8bb923a04f45d95
SHA1 881a275c2e6a1ed26d04f5707338f75c381b8de5
SHA512 21c8c1800b849e17bb2cbdce36752a6790950b37a613efaa2236bc9f45e6bd4ca075109203b27e48381ae32011c9ed71c2d6bfce3ee975a4625546a06538c384
SSDEEP 1536:zR1B8iqlVZRGWcAL4rMeV0HB3PE3+GnTGqVkbutpPljdzXgPw83wYk58e8hp:9n8U0Z/EOVqV8OVdzXgPwL8e8hp
MD5 SHA1 SHA512 SSDEEP

Submit Download

fS298353.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fS298353.exe
Size 1.2MB
SHA256 890e5fe0e3df7aff42063d5acf93e98f8c0673c210eded3edfa5ea5af8a4d447
MD5 ab4908704267b184dcf074635c1b009c
SHA1 8996fccc7c10cb8cd459de6e66c43fdf9223613e
SHA512 694ff0d06559cd079746149fdc88a0ec6872a90499f88da445c045a12e9da89bd230e164fc5b8d25f83e04a9b7388eab59e13a895b5ec5a53e4735fe4079c777
SSDEEP 24576:jynrm7hJZjkNmlybI3rEtzpxFijFlC0Ur0uf9UmjIhs9IszM:2KN6mIU3YttDijvC0Ur0ufio
MD5 SHA1 SHA512 SSDEEP

Submit Download

d13355996.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d13355996.exe
Size 576KB
SHA256 2798ec79756fcaa956b408145f639f16a5d71fc4d67af521f7395d42b85d489b
MD5 de608363a968cc002bf5277f2685997a
SHA1 f71b821c26c9a88049aa0fc5fbdf07431cf1d718
SHA512 6509a77fca681b20ca83c11cf350055a69e16f51ea3cd6429ed50b1f9fc5b52c4122e7cc3f69b0a3ee90942e37b1d9b829bdaabddb1ca274730643939cb40f4a
SSDEEP 12288:68Lx8V4JrnK6sNHpH8qaVjIRhNQLkMIFyvvp:6Wx5re8pjIJWdIFix
MD5 SHA1 SHA512 SSDEEP

Submit Download

yP168367.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yP168367.exe
Size 726KB
SHA256 0bc16c3d2d5a079eef350adce204620104af918db623157d9fe2ea7c7f1f6b01
MD5 d44332ad68d48e0b7b9bd85a5f916219
SHA1 b701dc94943c4649172a72580f7a107d145500ea
SHA512 f18b8d8a30b4329ad37a58d4e4bdcab3e416dc1a274e06b40b43e6757ec3bbc79438cbd24f7bac834059b35bf54027046fef757b0d781bc8fbce16ee8ebf0bdf
SSDEEP 12288:Vy90nfvrZorpS/ImB/42fKTteKkAF7kW8CrL0iVE1J4VY0yGg4r7fUD8g0ugi:VyOvKrihEtZ+W8iX7FrDU70uJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

c17816032.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c17816032.exe
Size 205KB
SHA256 8aa263b3be42f28e334faa0f0427e5c198e3d53283636c6e5421d1afee60904a
MD5 efe325f8f2e8e2c2d49802c17e876972
SHA1 c765f02445897f398378905e2ac1a2daf27d753a
SHA512 513619d94f18166801870246a468de06657f6c733805bb87de1f724ccc2784338f3384422082de68c4572b723bc99fe28487eb8a8f590569b4e02ee701836923
SSDEEP 3072:c/frTDzurT1S3CzpdmnATE55zjExkKGruONMvhu5QTXzeJX2vkMfSDPwU:Wfrnzurs3Czpexj2kGOIu5QTyJMKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ds517465.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ds517465.exe
Size 555KB
SHA256 47780fc5975f573f6227db3c9b7d23bd482c56c8c8e7da6ddd1358f09ddd5ecf
MD5 76c1cef72c5775893990cbdffd806aa2
SHA1 8f7ecfb07c98e91e1a874df013e35a0ac89dd2e5
SHA512 b256f7119516871b5aa59be2244f16e6ea49bdfda1236003d5e2a646c05e2f000d91096155be6dd64f80451ec9aa248ca65f68b199542d698ff022a983b87ee3
SSDEEP 12288:Uy90ymrpSmIwi/42zKWtTK3AFDQW8CADxiB5BhR4JY0FGSHnG:UyArzidtPGWtvhq7LG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a72581543.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a72581543.exe
Size 302KB
SHA256 e2bd0dbf1016910629148bc02ffc763360142d5288a13e41ac99f7ca1170efc5
MD5 ea45b067a6ccf883b8244eeeba645bc2
SHA1 c77f2f4b632e64a1a4c0435024804d7eda51f19f
SHA512 899d4443e4da30efeca095ee3c303f6531369d0d9bf2ace32585bdc556cc9bf555bc7dd565c44bf946df4ffa1e5d37e13fc34acff7435326512c9b5b9d31623b
SSDEEP 6144:sDKW1Lgbdl0TBBvjc/Ovb+8Lyh6Ct/4xg+NoMAFzu0HE9lA2:6h1Lk70TnvjcYbnstT+3AF6H
MD5 SHA1 SHA512 SSDEEP

Submit Download

b25092743.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b25092743.exe
Size 393KB
SHA256 35770ea23b49967925decf0a86aa03b133eecad12d4c548b297e39a219a39e30
MD5 978395e037ebdc20abe0bf103e88dbd6
SHA1 b0c40e2229d37eb11964f67f93c75885e0a8a269
SHA512 2d8ccc1b0986ae413b7e3eae4a52a0eee4b58d157380f3b46f517d36a23832c1e759882541678a62251062595859e64953bab9a83c7e349d421e890bf0bc1ac3
SSDEEP 6144:obuV7Jj4Rm7txAs3NKkea/h0gKT1gKZt/vGdafqA:obu5Jj4sBxhK5EhRwd/v7
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.exe

Path C:\Windows\Temp\1.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.exe

Path C:\Windows\Temp\1.exe
Size 168KB
SHA256 8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
MD5 f16fb63d4e551d3808e8f01f2671b57e
SHA1 781153ad6235a1152da112de1fb39a6f2d063575
SHA512 fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
SSDEEP 1536:LS0JRHDbl9L3qlVZRGWq72rDTTuUMFwftiwwK5TGqVobuIVHtuTIi83wYkF8e8hE:LbHDblFHqTuDFQIqVYhNuTIir8e8hE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3464-65-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-51-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-91-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-101-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-99-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-97-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-95-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-93-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-89-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-87-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-85-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-83-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-81-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-79-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-76-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-73-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-72-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-69-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-67-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-36-0x0000000004C40000-0x00000000051E4000-memory.dmp

Download

memory/3464-61-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-59-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-57-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-55-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-53-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-37-0x0000000002490000-0x00000000024E6000-memory.dmp

Download

memory/3464-49-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-47-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-45-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-44-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-41-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-39-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-38-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-77-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-63-0x0000000002490000-0x00000000024E1000-memory.dmp

Download

memory/3464-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp

Download

memory/3464-35-0x0000000002390000-0x00000000023E8000-memory.dmp

Download

memory/5228-4399-0x0000000004C10000-0x0000000004D1A000-memory.dmp

Download

memory/5228-4406-0x0000000004D20000-0x0000000004D6C000-memory.dmp

Download

memory/5228-4405-0x0000000004B90000-0x0000000004BCC000-memory.dmp

Download

memory/5228-4400-0x0000000004B30000-0x0000000004B42000-memory.dmp

Download

memory/5228-4396-0x00000000001B0000-0x00000000001DE000-memory.dmp

Download

memory/5228-4397-0x0000000000950000-0x0000000000956000-memory.dmp

Download

memory/5228-4398-0x0000000005120000-0x0000000005738000-memory.dmp

Download

memory/6276-2181-0x00000000004D0000-0x00000000004DA000-memory.dmp

Download

memory/6304-2184-0x00000000023A0000-0x00000000023BA000-memory.dmp

Download

memory/6304-2185-0x0000000002690000-0x00000000026A8000-memory.dmp

Download

memory/6708-4407-0x00000000009B0000-0x00000000009E0000-memory.dmp

Download

memory/6708-4408-0x0000000002B80000-0x0000000002B86000-memory.dmp

Download

memory/7096-2236-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/7096-2235-0x0000000002550000-0x00000000025B8000-memory.dmp

Download

memory/7096-4383-0x0000000005770000-0x00000000057A2000-memory.dmp

Download