amadey | 8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe
Size

1.1MB
MD5

98fc8194e216fb6bea0f1c68e1923555
SHA1

b05a1966e297b70f66ac03e14755646b365ba7dc
SHA256

8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a
SHA512

0f51e76972b5f50a771e8bd573108d460b6605ea57fc9f8393d2f04c35fe38733d6d2dc49cd710cf310261cfffa55328fd9182f0ba2945fb1504377ae02d93d3
SSDEEP

24576:IyujJJMdc2oafhwwjnX0soqbL6UdmDgBGdnMGhZlD2:PulJop6wjX/p2UdmDY+XN

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/512-28-0x0000000002160000-0x000000000217A000-memory.dmp	healer
behavioral1/memory/512-30-0x0000000002360000-0x0000000002378000-memory.dmp	healer
behavioral1/memory/512-48-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-58-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-56-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-54-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-52-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-50-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-46-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-45-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-42-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-40-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-39-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-31-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-36-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-34-0x0000000002360000-0x0000000002373000-memory.dmp	healer
behavioral1/memory/512-32-0x0000000002360000-0x0000000002373000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	258993532.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	258993532.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	258993532.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	258993532.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	258993532.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/3928-112-0x0000000004C70000-0x0000000004CAC000-memory.dmp	family_redline
behavioral1/memory/3928-113-0x0000000004E30000-0x0000000004E6A000-memory.dmp	family_redline
behavioral1/memory/3928-117-0x0000000004E30000-0x0000000004E65000-memory.dmp	family_redline
behavioral1/memory/3928-115-0x0000000004E30000-0x0000000004E65000-memory.dmp	family_redline
behavioral1/memory/3928-114-0x0000000004E30000-0x0000000004E65000-memory.dmp	family_redline
behavioral1/memory/3928-119-0x0000000004E30000-0x0000000004E65000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	349748394.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
1724	oP055905.exe
4260	dV152326.exe
1244	sc748244.exe
512	139034430.exe
964	258993532.exe
2636	349748394.exe
1316	oneetx.exe
3928	486946552.exe
1760	oneetx.exe
4416	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	139034430.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	258993532.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	oP055905.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	dV152326.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	sc748244.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	964	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oP055905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	139034430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dV152326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	349748394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	486946552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc748244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	258993532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
512	139034430.exe
512	139034430.exe
964	258993532.exe
964	258993532.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	139034430.exe
Token: SeDebugPrivilege	964	258993532.exe
Token: SeDebugPrivilege	3928	486946552.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	349748394.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1724	4088	8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe	84
PID 4088 wrote to memory of 1724	4088	8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe	84
PID 4088 wrote to memory of 1724	4088	8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe	84
PID 1724 wrote to memory of 4260	1724	oP055905.exe	86
PID 1724 wrote to memory of 4260	1724	oP055905.exe	86
PID 1724 wrote to memory of 4260	1724	oP055905.exe	86
PID 4260 wrote to memory of 1244	4260	dV152326.exe	87
PID 4260 wrote to memory of 1244	4260	dV152326.exe	87
PID 4260 wrote to memory of 1244	4260	dV152326.exe	87
PID 1244 wrote to memory of 512	1244	sc748244.exe	88
PID 1244 wrote to memory of 512	1244	sc748244.exe	88
PID 1244 wrote to memory of 512	1244	sc748244.exe	88
PID 1244 wrote to memory of 964	1244	sc748244.exe	94
PID 1244 wrote to memory of 964	1244	sc748244.exe	94
PID 1244 wrote to memory of 964	1244	sc748244.exe	94
PID 4260 wrote to memory of 2636	4260	dV152326.exe	98
PID 4260 wrote to memory of 2636	4260	dV152326.exe	98
PID 4260 wrote to memory of 2636	4260	dV152326.exe	98
PID 2636 wrote to memory of 1316	2636	349748394.exe	99
PID 2636 wrote to memory of 1316	2636	349748394.exe	99
PID 2636 wrote to memory of 1316	2636	349748394.exe	99
PID 1724 wrote to memory of 3928	1724	oP055905.exe	100
PID 1724 wrote to memory of 3928	1724	oP055905.exe	100
PID 1724 wrote to memory of 3928	1724	oP055905.exe	100
PID 1316 wrote to memory of 3100	1316	oneetx.exe	101
PID 1316 wrote to memory of 3100	1316	oneetx.exe	101
PID 1316 wrote to memory of 3100	1316	oneetx.exe	101
PID 1316 wrote to memory of 1876	1316	oneetx.exe	103
PID 1316 wrote to memory of 1876	1316	oneetx.exe	103
PID 1316 wrote to memory of 1876	1316	oneetx.exe	103
PID 1876 wrote to memory of 4888	1876	cmd.exe	105
PID 1876 wrote to memory of 4888	1876	cmd.exe	105
PID 1876 wrote to memory of 4888	1876	cmd.exe	105
PID 1876 wrote to memory of 4128	1876	cmd.exe	106
PID 1876 wrote to memory of 4128	1876	cmd.exe	106
PID 1876 wrote to memory of 4128	1876	cmd.exe	106
PID 1876 wrote to memory of 4956	1876	cmd.exe	107
PID 1876 wrote to memory of 4956	1876	cmd.exe	107
PID 1876 wrote to memory of 4956	1876	cmd.exe	107
PID 1876 wrote to memory of 4884	1876	cmd.exe	108
PID 1876 wrote to memory of 4884	1876	cmd.exe	108
PID 1876 wrote to memory of 4884	1876	cmd.exe	108
PID 1876 wrote to memory of 3956	1876	cmd.exe	109
PID 1876 wrote to memory of 3956	1876	cmd.exe	109
PID 1876 wrote to memory of 3956	1876	cmd.exe	109
PID 1876 wrote to memory of 4016	1876	cmd.exe	110
PID 1876 wrote to memory of 4016	1876	cmd.exe	110
PID 1876 wrote to memory of 4016	1876	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe
"C:\Users\Admin\AppData\Local\Temp\8173bd2340808c2884c57ac5b810ba12fec0f0affa90a86c185c129e9d9aba2a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oP055905.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oP055905.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dV152326.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dV152326.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sc748244.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sc748244.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\139034430.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\139034430.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:512
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\258993532.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\258993532.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 1084
        6⤵
        Program crash
        
        PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\349748394.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\349748394.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1316
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3100
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\486946552.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\486946552.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 964 -ip 964
1⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oP055905.exe

Filesize
925KB

MD5
81050044751ea357c03f90e3ab7c50cc

SHA1
4b1ebdfc54dc99d5c8709b962d82b51f8e8c1c77

SHA256
ea18fcb505b9b9c2c33e7172c9d8ef7da1362dc37b4e313685c7176844edffa8

SHA512
091f777c53a1bf7cbd46e836a3efd6098e5d5d052f50c82a1e32db92158db818ee0d1f4e3f2d1026a5300bd8726c34f809993862cb9e53b416ad1db535f3990f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\486946552.exe

Filesize
328KB

MD5
c6b4c0d548d919b5d3b0479326f6e876

SHA1
8740fc1f27ab6f8fe469a25be4b5e612283cf183

SHA256
928fa88c831cd14c34dadbed0d3fde3f4e3c42ff750fc0c207f382a658fc10e9

SHA512
61c81377c86eea432b6d837d8c62df7692705856f33931d6864f5451453e224950b1388bcb21058a1c747322888d4e1e1045e706194a6184016b7d2e67f4e198

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dV152326.exe

Filesize
582KB

MD5
da45f57f116075039b5d9692322545fa

SHA1
e726e9aecb51ec9e3a5738a47c0259c9e9c66295

SHA256
555265372eca061dcde8fbdd0083a2a23d419f9b509feeaf4621ca8586455286

SHA512
d28e9b4ab600f7e19e9525a36e8e27cc9cd9271cd862cd99ebaedc414770e26c9b6774f42f67f0fdf55269ae7b4401782643b0b150c69dc3892f64e459ca578e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\349748394.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sc748244.exe

Filesize
411KB

MD5
d0798272ae05daafefc9e24376476969

SHA1
4f9188af9783e117dae2937b9aca560c9ede1a1e

SHA256
34d46501acf55ff7162e9b7065b58c879420da7cefaa0539f72e6df60b6ede84

SHA512
eed9a5df73a2fe4c0510c079c646add7eb0d162b619ea32dd17aee976ac7e0a4697bc5f81609855a7e2ec617f27c2a31877b224a3316c4b84bfc6c3c5995a36d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\139034430.exe

Filesize
175KB

MD5
3d10b67208452d7a91d7bd7066067676

SHA1
e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

SHA256
5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

SHA512
b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\258993532.exe

Filesize
263KB

MD5
27015d106033f1ec0e89521b7b3ecf77

SHA1
81bd3b9f6762b66776dee8af9ada4f32de934cfa

SHA256
511a4f3666541738dc6914b73b6994a8962e08113dcd070811976b61afbc203b

SHA512
274c706c3dd521cad4f889136fc2bab44f20a3d04d448d95a65e7896ef0a4c1f8c91b9a8c26050061866b1902d9c8b740158fe6f6c28af11d58304f0c00db405

Download Submit
memory/512-31-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-30-0x0000000002360000-0x0000000002378000-memory.dmp

Filesize
96KB

Download
memory/512-56-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-54-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-52-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-50-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-46-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-45-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-42-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-40-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-39-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-48-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-36-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-34-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-32-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-58-0x0000000002360000-0x0000000002373000-memory.dmp

Filesize
76KB

Download
memory/512-28-0x0000000002160000-0x000000000217A000-memory.dmp

Filesize
104KB

Download
memory/512-29-0x0000000004AF0000-0x0000000005094000-memory.dmp

Filesize
5.6MB

Download
memory/964-94-0x0000000000400000-0x0000000002B99000-memory.dmp

Filesize
39.6MB

Download
memory/964-92-0x0000000000400000-0x0000000002B99000-memory.dmp

Filesize
39.6MB

Download
memory/3928-114-0x0000000004E30000-0x0000000004E65000-memory.dmp

Filesize
212KB

Download
memory/3928-113-0x0000000004E30000-0x0000000004E6A000-memory.dmp

Filesize
232KB

Download
memory/3928-117-0x0000000004E30000-0x0000000004E65000-memory.dmp

Filesize
212KB

Download
memory/3928-115-0x0000000004E30000-0x0000000004E65000-memory.dmp

Filesize
212KB

Download
memory/3928-112-0x0000000004C70000-0x0000000004CAC000-memory.dmp

Filesize
240KB

Download
memory/3928-119-0x0000000004E30000-0x0000000004E65000-memory.dmp

Filesize
212KB

Download
memory/3928-906-0x000000000A340000-0x000000000A958000-memory.dmp

Filesize
6.1MB

Download
memory/3928-907-0x00000000072C0000-0x00000000072D2000-memory.dmp

Filesize
72KB

Download
memory/3928-908-0x0000000009D20000-0x0000000009E2A000-memory.dmp

Filesize
1.0MB

Download
memory/3928-909-0x0000000009E40000-0x0000000009E7C000-memory.dmp

Filesize
240KB

Download
memory/3928-910-0x0000000004A50000-0x0000000004A9C000-memory.dmp

Filesize
304KB

Download