amadey | 2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe
Size

1.7MB
MD5

e9237c462bfe0540d04eee91c0a19968
SHA1

d45ef2cea1f89dd6e376910ada84d07b1fc88e8a
SHA256

2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387
SHA512

3247c6c193206c0bcb6a33925b47e957367573050bb7b54b5d96bb39acf1522fa35ecde05fe0df94f4d5ef9ffc658b656ee32a4efb4e02973f5d7e7c1771a619
SSDEEP

24576:AyjemNsVPMdViq9JWQ00PqRcfVoVLTnzgYqx76CjqAi94prFPQnkit7VhYx:HymKpo98Q1toVLTnYr04prRQTV8

Score

10^/10

amadey healer redline 9c0adb gena most discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/5008-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp	healer
behavioral1/files/0x000500000001e56e-2171.dat	healer
behavioral1/memory/5244-2179-0x0000000000BC0000-0x0000000000BCA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/3976-6481-0x0000000005780000-0x00000000057B2000-memory.dmp	family_redline
behavioral1/files/0x000500000001e56e-6486.dat	family_redline
behavioral1/memory/5856-6494-0x0000000000440000-0x000000000046E000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c8f-6502.dat	family_redline
behavioral1/memory/3492-6504-0x00000000009E0000-0x0000000000A10000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	d54887561.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	a54612647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	c20271866.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 14 IoCs

pid	Process
5004	BM535491.exe
244	MP850774.exe
2696	Mx877067.exe
1860	qk603608.exe
5008	a54612647.exe
5244	1.exe
3948	b23554780.exe
6032	c20271866.exe
5848	oneetx.exe
3976	d54887561.exe
5856	1.exe
3492	f90230056.exe
1476	oneetx.exe
4920	oneetx.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	BM535491.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	MP850774.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Mx877067.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	qk603608.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5420	3948	WerFault.exe	92
2900	3976	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d54887561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f90230056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MP850774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BM535491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qk603608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a54612647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c20271866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mx877067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b23554780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5244	1.exe
5244	1.exe
5244	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	a54612647.exe
Token: SeDebugPrivilege	3948	b23554780.exe
Token: SeDebugPrivilege	5244	1.exe
Token: SeDebugPrivilege	3976	d54887561.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 5004	3176	2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe	83
PID 3176 wrote to memory of 5004	3176	2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe	83
PID 3176 wrote to memory of 5004	3176	2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe	83
PID 5004 wrote to memory of 244	5004	BM535491.exe	85
PID 5004 wrote to memory of 244	5004	BM535491.exe	85
PID 5004 wrote to memory of 244	5004	BM535491.exe	85
PID 244 wrote to memory of 2696	244	MP850774.exe	87
PID 244 wrote to memory of 2696	244	MP850774.exe	87
PID 244 wrote to memory of 2696	244	MP850774.exe	87
PID 2696 wrote to memory of 1860	2696	Mx877067.exe	89
PID 2696 wrote to memory of 1860	2696	Mx877067.exe	89
PID 2696 wrote to memory of 1860	2696	Mx877067.exe	89
PID 1860 wrote to memory of 5008	1860	qk603608.exe	90
PID 1860 wrote to memory of 5008	1860	qk603608.exe	90
PID 1860 wrote to memory of 5008	1860	qk603608.exe	90
PID 5008 wrote to memory of 5244	5008	a54612647.exe	91
PID 5008 wrote to memory of 5244	5008	a54612647.exe	91
PID 1860 wrote to memory of 3948	1860	qk603608.exe	92
PID 1860 wrote to memory of 3948	1860	qk603608.exe	92
PID 1860 wrote to memory of 3948	1860	qk603608.exe	92
PID 2696 wrote to memory of 6032	2696	Mx877067.exe	102
PID 2696 wrote to memory of 6032	2696	Mx877067.exe	102
PID 2696 wrote to memory of 6032	2696	Mx877067.exe	102
PID 6032 wrote to memory of 5848	6032	c20271866.exe	103
PID 6032 wrote to memory of 5848	6032	c20271866.exe	103
PID 6032 wrote to memory of 5848	6032	c20271866.exe	103
PID 244 wrote to memory of 3976	244	MP850774.exe	104
PID 244 wrote to memory of 3976	244	MP850774.exe	104
PID 244 wrote to memory of 3976	244	MP850774.exe	104
PID 5848 wrote to memory of 3952	5848	oneetx.exe	105
PID 5848 wrote to memory of 3952	5848	oneetx.exe	105
PID 5848 wrote to memory of 3952	5848	oneetx.exe	105
PID 5848 wrote to memory of 6104	5848	oneetx.exe	107
PID 5848 wrote to memory of 6104	5848	oneetx.exe	107
PID 5848 wrote to memory of 6104	5848	oneetx.exe	107
PID 6104 wrote to memory of 3396	6104	cmd.exe	109
PID 6104 wrote to memory of 3396	6104	cmd.exe	109
PID 6104 wrote to memory of 3396	6104	cmd.exe	109
PID 6104 wrote to memory of 4540	6104	cmd.exe	110
PID 6104 wrote to memory of 4540	6104	cmd.exe	110
PID 6104 wrote to memory of 4540	6104	cmd.exe	110
PID 6104 wrote to memory of 372	6104	cmd.exe	111
PID 6104 wrote to memory of 372	6104	cmd.exe	111
PID 6104 wrote to memory of 372	6104	cmd.exe	111
PID 6104 wrote to memory of 5824	6104	cmd.exe	112
PID 6104 wrote to memory of 5824	6104	cmd.exe	112
PID 6104 wrote to memory of 5824	6104	cmd.exe	112
PID 6104 wrote to memory of 1776	6104	cmd.exe	113
PID 6104 wrote to memory of 1776	6104	cmd.exe	113
PID 6104 wrote to memory of 1776	6104	cmd.exe	113
PID 6104 wrote to memory of 4724	6104	cmd.exe	114
PID 6104 wrote to memory of 4724	6104	cmd.exe	114
PID 6104 wrote to memory of 4724	6104	cmd.exe	114
PID 3976 wrote to memory of 5856	3976	d54887561.exe	115
PID 3976 wrote to memory of 5856	3976	d54887561.exe	115
PID 3976 wrote to memory of 5856	3976	d54887561.exe	115
PID 5004 wrote to memory of 3492	5004	BM535491.exe	118
PID 5004 wrote to memory of 3492	5004	BM535491.exe	118
PID 5004 wrote to memory of 3492	5004	BM535491.exe	118

C:\Users\Admin\AppData\Local\Temp\2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe
"C:\Users\Admin\AppData\Local\Temp\2e0efbd4c706b4676d0fa86e51465397595ad25d6fef989dd2b7f6c1b5271387.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BM535491.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BM535491.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MP850774.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MP850774.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Mx877067.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Mx877067.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\qk603608.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\qk603608.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a54612647.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a54612647.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b23554780.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b23554780.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1256
        7⤵
        Program crash
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c20271866.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c20271866.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5848
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d54887561.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d54887561.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1384
        5⤵
        Program crash
        
        PID:2900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f90230056.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f90230056.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3948 -ip 3948
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3976 -ip 3976
1⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BM535491.exe

Filesize
1.4MB

MD5
a116d8352d5057459bfa9c9c09ce555f

SHA1
e7883f8f0a3bfda412738f1af7863a28c9c6b143

SHA256
6465d4f7f50a50861debf2c4ef91a1f4cc8c27300237365cda2e1a0cfb7aba60

SHA512
5766117b12339f9eac3e9c829cb3ca215dd97fd80db998ee95cb2302c74fcee47d264e766220f8f87e776dedb82d938f329c69957cd8ecb0744185c348927cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MP850774.exe

Filesize
1.3MB

MD5
3314785a294905ef89b32e5027bc5033

SHA1
77f88c599d0cb72525f5cf1f010232763a80d6b9

SHA256
1030e3d27c4fb4071db6589a35f70efd390af9445c1feda4acc156a0de6dd6f2

SHA512
d94405bff3dfc1cd8b043903c2d1ea297845fb445d7ca69cc05e47cfd0cbde87c8ae4f4d66c71e84622fc2ce85c5cdb2e96fb1755f753ae661c984bf7b6c8f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f90230056.exe

Filesize
168KB

MD5
1888d552421b20ffa4050c8c31f9585e

SHA1
957f2f09c3ef9c3127c883dfebcb60a2ead22a28

SHA256
d673b50f8e7e47685372bfc2e095972767ae23e97a218de4d6e6d8fdfb02555e

SHA512
d21f5ac6da60964fed2e1683a3c91de37c362db54ecf9dfecd656f75719e1c419f2561639527e0266ad4b9260a86d193ddff28a4c2df3413b74c937c8a929183

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Mx877067.exe

Filesize
850KB

MD5
485832642be85637900820691c2bc2fe

SHA1
451ecb71226f633f965b322740ea71084457432d

SHA256
ef986777fcaf093ea4ba4ba50b852f60ade976edff9c2ce283a5b8cffdbbcb5a

SHA512
33103cb92b32fa7845b4840258acc456edb42e1b09d8bace381825b55c259577b8eac7a9890258761bb59d7fc8c08214950034b616c952b63839cfb52a06918b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d54887561.exe

Filesize
582KB

MD5
3b7eb68ff9c2e3b800885ed5fe7d5e29

SHA1
9e7784194e9480c1151e0a6c0f92e4b61ea0328d

SHA256
c0b3f50045fa6aaf7d031c51617f3c15b0944700709a9debdc125713ff1a42e2

SHA512
4c71ea61f6203915205533cf323d52fa01deb7288cef9456af5a153bf00a4029fe0b8c641128060efdce179675c6389ba98924ae0ac6268185362f098f60cf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c20271866.exe

Filesize
205KB

MD5
c104370c372867313bbc775f64ac10f2

SHA1
88fef5a50eff6778ee5135d6b12d6342ff8d7d63

SHA256
dca97c376829cc4d26b7391ec800c9d802e84bcfdacc8a3dbc37547b18231297

SHA512
be3f40739e6ae0cf95ab8bf767eb2654f248a59022ec20cf2f9fa795204807b10425b84c8b9a0ecf8ec7b51e6aa9bdf3ca1230547efc8471153e6ce30cd02001

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\qk603608.exe

Filesize
679KB

MD5
90e74bb50f16ba464a3e40cf3ae967e9

SHA1
2d3bc76d9bb215f8ce1cb7f0090e735976ea6db7

SHA256
5f4b407cdb9a9d472b814e698a8b698135b9967b2ffa4e2fb7b11ca10bb441fa

SHA512
69c49e56bc21c6969218a734d8cf30692e4e788e767f0b1a3c6cd57b7a21d8d3461934a5895e53e761a5b8c355ac425a1107a15f271a50c788f42b951ba2f256

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a54612647.exe

Filesize
301KB

MD5
2a8e8f50eb9d1b52afa7ebe31db0cdc0

SHA1
cefba81557b27c4c187a1fff3e46c5510855cd77

SHA256
04598734e3f8a0e222f594203cbdfeb7ddae7d110783b5dc80c455da4a6439ee

SHA512
fb2e27ae31e810eb31190b24871d5be6a7b8270ce85207bca05eaa2402b5379f131400b1f136fa03be390f91a1b88cbfb00f8e1d96495e0fe8df399bf79fa316

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b23554780.exe

Filesize
521KB

MD5
107b88cd2272f71134be1bc8ee87c461

SHA1
b6bf46dc22548f183498f934d13623819332ad4b

SHA256
4c7d9c0288e505ecf4de981bd3420aec86cf5f725b0fee86fc790db57eced744

SHA512
fc28b52d615be76eaf12061da8f21254029e39b359a64571102aa94377888e0dad4048a0d10652fc51c957bc88f6a74a5622a6657e25515740269c232ecfdb28

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/3492-6504-0x00000000009E0000-0x0000000000A10000-memory.dmp

Filesize
192KB

Download
memory/3492-6505-0x00000000050C0000-0x00000000050C6000-memory.dmp

Filesize
24KB

Download
memory/3948-4312-0x0000000005750000-0x00000000057E2000-memory.dmp

Filesize
584KB

Download
memory/3976-6481-0x0000000005780000-0x00000000057B2000-memory.dmp

Filesize
200KB

Download
memory/3976-4333-0x00000000055B0000-0x0000000005616000-memory.dmp

Filesize
408KB

Download
memory/3976-4332-0x0000000004E10000-0x0000000004E78000-memory.dmp

Filesize
416KB

Download
memory/5008-89-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-38-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-81-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-79-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-75-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-73-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-71-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-69-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-67-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-63-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-61-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-57-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-55-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-53-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-51-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-49-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-47-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-45-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-43-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-41-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-97-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-77-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-65-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-83-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/5008-85-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-35-0x00000000049A0000-0x00000000049F8000-memory.dmp

Filesize
352KB

Download
memory/5008-87-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-91-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-93-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-95-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-99-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-101-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-59-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-39-0x0000000004FB0000-0x0000000005001000-memory.dmp

Filesize
324KB

Download
memory/5008-36-0x0000000004A00000-0x0000000004FA4000-memory.dmp

Filesize
5.6MB

Download
memory/5008-37-0x0000000004FB0000-0x0000000005006000-memory.dmp

Filesize
344KB

Download
memory/5244-2179-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download
memory/5856-6496-0x00000000053F0000-0x0000000005A08000-memory.dmp

Filesize
6.1MB

Download
memory/5856-6497-0x0000000004EE0000-0x0000000004FEA000-memory.dmp

Filesize
1.0MB

Download
memory/5856-6498-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/5856-6500-0x0000000004E30000-0x0000000004E6C000-memory.dmp

Filesize
240KB

Download
memory/5856-6495-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/5856-6494-0x0000000000440000-0x000000000046E000-memory.dmp

Filesize
184KB

Download
memory/5856-6506-0x0000000004E70000-0x0000000004EBC000-memory.dmp

Filesize
304KB

Download