amadey | fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe
Size

1.2MB
MD5

2d9bd3afb6e4f14fe0b405705048b319
SHA1

2547084fedcbaa139122850615571e8dd26307b8
SHA256

fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb
SHA512

d98be1ef7d278b410a2f051628dda9b19098fa9a6d7719857977d42036b2648fc5bdadae3934aa5a61b54937a4be7836d3e81487c11b7add5f2551169597fade
SSDEEP

24576:PyQivDY6jQap98NhkRK7DWjfkCtfNo+fgEEAC6/Z7BysWIF0hfsK7:aQN6cfNh8oybpfNDgEC6/Z78sWu0hfsK

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 34 IoCs

resource	yara_rule
behavioral1/memory/4940-28-0x0000000000770000-0x000000000078A000-memory.dmp	healer
behavioral1/memory/4940-30-0x0000000002300000-0x0000000002318000-memory.dmp	healer
behavioral1/memory/4940-40-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-42-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-55-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-52-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-48-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-46-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-44-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-38-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-36-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-34-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-58-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-56-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-50-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-31-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/4940-32-0x0000000002300000-0x0000000002313000-memory.dmp	healer
behavioral1/memory/1056-64-0x00000000026D0000-0x00000000026EA000-memory.dmp	healer
behavioral1/memory/1056-65-0x0000000004DA0000-0x0000000004DB8000-memory.dmp	healer
behavioral1/memory/1056-67-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-73-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-93-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-91-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-89-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-87-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-83-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-81-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-79-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-77-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-75-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-71-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-69-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-85-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1056-66-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	264278507.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	264278507.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	264278507.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	264278507.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	264278507.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	132647858.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/3100-114-0x00000000025A0000-0x00000000025DC000-memory.dmp	family_redline
behavioral1/memory/3100-115-0x0000000002890000-0x00000000028CA000-memory.dmp	family_redline
behavioral1/memory/3100-119-0x0000000002890000-0x00000000028C5000-memory.dmp	family_redline
behavioral1/memory/3100-117-0x0000000002890000-0x00000000028C5000-memory.dmp	family_redline
behavioral1/memory/3100-116-0x0000000002890000-0x00000000028C5000-memory.dmp	family_redline
behavioral1/memory/3100-121-0x0000000002890000-0x00000000028C5000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	386455376.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
3492	Fm207959.exe
3264	KW645399.exe
1020	Ka444276.exe
4940	132647858.exe
1056	264278507.exe
1968	386455376.exe
3904	oneetx.exe
3100	447478596.exe
2256	oneetx.exe
4312	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	132647858.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	264278507.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Fm207959.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	KW645399.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Ka444276.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
556	1056	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	264278507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fm207959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KW645399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	386455376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	447478596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ka444276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132647858.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4940	132647858.exe
4940	132647858.exe
1056	264278507.exe
1056	264278507.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	132647858.exe
Token: SeDebugPrivilege	1056	264278507.exe
Token: SeDebugPrivilege	3100	447478596.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3492	4740	fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe	83
PID 4740 wrote to memory of 3492	4740	fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe	83
PID 4740 wrote to memory of 3492	4740	fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe	83
PID 3492 wrote to memory of 3264	3492	Fm207959.exe	84
PID 3492 wrote to memory of 3264	3492	Fm207959.exe	84
PID 3492 wrote to memory of 3264	3492	Fm207959.exe	84
PID 3264 wrote to memory of 1020	3264	KW645399.exe	85
PID 3264 wrote to memory of 1020	3264	KW645399.exe	85
PID 3264 wrote to memory of 1020	3264	KW645399.exe	85
PID 1020 wrote to memory of 4940	1020	Ka444276.exe	87
PID 1020 wrote to memory of 4940	1020	Ka444276.exe	87
PID 1020 wrote to memory of 4940	1020	Ka444276.exe	87
PID 1020 wrote to memory of 1056	1020	Ka444276.exe	98
PID 1020 wrote to memory of 1056	1020	Ka444276.exe	98
PID 1020 wrote to memory of 1056	1020	Ka444276.exe	98
PID 3264 wrote to memory of 1968	3264	KW645399.exe	103
PID 3264 wrote to memory of 1968	3264	KW645399.exe	103
PID 3264 wrote to memory of 1968	3264	KW645399.exe	103
PID 1968 wrote to memory of 3904	1968	386455376.exe	104
PID 1968 wrote to memory of 3904	1968	386455376.exe	104
PID 1968 wrote to memory of 3904	1968	386455376.exe	104
PID 3492 wrote to memory of 3100	3492	Fm207959.exe	105
PID 3492 wrote to memory of 3100	3492	Fm207959.exe	105
PID 3492 wrote to memory of 3100	3492	Fm207959.exe	105
PID 3904 wrote to memory of 1712	3904	oneetx.exe	106
PID 3904 wrote to memory of 1712	3904	oneetx.exe	106
PID 3904 wrote to memory of 1712	3904	oneetx.exe	106
PID 3904 wrote to memory of 1324	3904	oneetx.exe	108
PID 3904 wrote to memory of 1324	3904	oneetx.exe	108
PID 3904 wrote to memory of 1324	3904	oneetx.exe	108
PID 1324 wrote to memory of 2748	1324	cmd.exe	110
PID 1324 wrote to memory of 2748	1324	cmd.exe	110
PID 1324 wrote to memory of 2748	1324	cmd.exe	110
PID 1324 wrote to memory of 4192	1324	cmd.exe	111
PID 1324 wrote to memory of 4192	1324	cmd.exe	111
PID 1324 wrote to memory of 4192	1324	cmd.exe	111
PID 1324 wrote to memory of 1544	1324	cmd.exe	112
PID 1324 wrote to memory of 1544	1324	cmd.exe	112
PID 1324 wrote to memory of 1544	1324	cmd.exe	112
PID 1324 wrote to memory of 4472	1324	cmd.exe	113
PID 1324 wrote to memory of 4472	1324	cmd.exe	113
PID 1324 wrote to memory of 4472	1324	cmd.exe	113
PID 1324 wrote to memory of 4184	1324	cmd.exe	114
PID 1324 wrote to memory of 4184	1324	cmd.exe	114
PID 1324 wrote to memory of 4184	1324	cmd.exe	114
PID 1324 wrote to memory of 3056	1324	cmd.exe	115
PID 1324 wrote to memory of 3056	1324	cmd.exe	115
PID 1324 wrote to memory of 3056	1324	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe
"C:\Users\Admin\AppData\Local\Temp\fb12a596d32e7426b033d29878187eda1cb2afc953d109136f39b905261c80eb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fm207959.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fm207959.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KW645399.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KW645399.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ka444276.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ka444276.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\132647858.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\132647858.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\264278507.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\264278507.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1080
        6⤵
        Program crash
        
        PID:556
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\386455376.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\386455376.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1712
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\447478596.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\447478596.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1056 -ip 1056
1⤵
PID:4116

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fm207959.exe

Filesize
1.0MB

MD5
04feebbb6280d22fbd45ef4b845277fd

SHA1
729de13d63e954fcd2ffada3d7b485788cc0c5b3

SHA256
3d0374889b385f224ddf5ecef37b550705e4970013aafe1ca23d5cf8f3c91864

SHA512
5dde16dee27507874635aaea70ccb2894caec2fb50b56df5f54478b8708799a0869ec4bf473c5f691d9aa85dbc607477e2da776850353c523809a822ee34f3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\447478596.exe

Filesize
461KB

MD5
a633f63d01e7a58cb7cef4b2738cfb83

SHA1
2b51538b841d9b05f7bf61be38fdc86e5c7e484f

SHA256
2c1c59b41cc9ed7e93f79f96fcc5f1087bbeb229ade073a4097a15f162539179

SHA512
295217db5eb7c39f3c2796a1b2d5097ec62e84cf3dde03c760d5833c4179183eb3261cd1d8d071cf69b7180b7ca26fa79dd1876681e53cd5373a183006612e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KW645399.exe

Filesize
637KB

MD5
32726355d25763aefb981744bdb7f187

SHA1
18bc997637b667cb40a9ec7391060374c550eaa2

SHA256
772d0bfb518c361b3a8d3a1f36c67f8bcf24be0f51e880ac0edc5efb99647b51

SHA512
c84ae4282fee4cddc0ae23711eb3fab3e11f1d9306e8b3ad9f917cf556ddecb37732421cb30afa0223dea14e18b5d8e010e22390a57552c318af41a7b8664a4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\386455376.exe

Filesize
204KB

MD5
4b4e53dcb718638336fb48359be736ca

SHA1
ec40f843891e7675140cedddf0fdf2db8e89d750

SHA256
81caeb2b5222ad67c0b558c3e3c9c03a6122dc637366f60ffe9c5fbfeeb12367

SHA512
77161ebc17a43f45b14cabde20ba3b1a2e2efed33d76f8ab05c51daa49320ab0a53ffa5ada55a81bc6296ab88fe6c06deddb50d39c2c0caec37d11df2538fed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ka444276.exe

Filesize
466KB

MD5
ed76b73e43d048b4f6393a2406159aa3

SHA1
0e479a4bab01914d045d9c21116f5215f299195f

SHA256
331687b7b1347e84ee7a07ee86678af76bf5ee368ccd5e2f6770e675dfae62ac

SHA512
f4e2da95e47e554a5b6555b9b322df1caf557243def08bfb7c02790455a3b46b66a325eb33375d5ab41053241ba01b134f0c5f6b2578ceacd705672a9d1ca7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\132647858.exe

Filesize
176KB

MD5
6f6fb6ef958aa467f3b0893bba8ac5cf

SHA1
4fcbaf2f89b5f77b07e57a6548d73b12d702a071

SHA256
29cef6ec254a346774070fa3e8615af65354cdf9375090988e3b5e72f1eae87a

SHA512
af2788eaa5673ac9edb2c676cdd78954f0e8de602306fdaa917ff04d9c85e03c76a219d8533a48f931dc6f6f4f2a3b348b25313096e9baf2b79b88c57cf03738

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\264278507.exe

Filesize
377KB

MD5
f355deb3139031b04cfa137bd9ff238a

SHA1
8a2c1f5cda9be2fcddb0ff5d16015e8f46331563

SHA256
74fa5b8e1954cbb14d7282943023df4133577b9cb2298b94e396934828678554

SHA512
9d4c743847e397bb03cfc3cd2f2324c4d15501765ad3027c892b9dac0d723d98ed97e879749d2dd2d9590a65fd10b29ff90734f190d55dcaa938a46e647d0747

Download Submit
memory/1056-66-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-89-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-75-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-77-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-79-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-81-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-83-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-87-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-71-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-91-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-93-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-73-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-67-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-95-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/1056-85-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-69-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1056-64-0x00000000026D0000-0x00000000026EA000-memory.dmp

Filesize
104KB

Download
memory/1056-65-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

Filesize
96KB

Download
memory/3100-114-0x00000000025A0000-0x00000000025DC000-memory.dmp

Filesize
240KB

Download
memory/3100-115-0x0000000002890000-0x00000000028CA000-memory.dmp

Filesize
232KB

Download
memory/3100-119-0x0000000002890000-0x00000000028C5000-memory.dmp

Filesize
212KB

Download
memory/3100-117-0x0000000002890000-0x00000000028C5000-memory.dmp

Filesize
212KB

Download
memory/3100-116-0x0000000002890000-0x00000000028C5000-memory.dmp

Filesize
212KB

Download
memory/3100-121-0x0000000002890000-0x00000000028C5000-memory.dmp

Filesize
212KB

Download
memory/3100-908-0x0000000007910000-0x0000000007F28000-memory.dmp

Filesize
6.1MB

Download
memory/3100-909-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/3100-910-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/3100-911-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/3100-912-0x00000000024B0000-0x00000000024FC000-memory.dmp

Filesize
304KB

Download
memory/4940-50-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-40-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-32-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-30-0x0000000002300000-0x0000000002318000-memory.dmp

Filesize
96KB

Download
memory/4940-31-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-29-0x00000000049B0000-0x0000000004F54000-memory.dmp

Filesize
5.6MB

Download
memory/4940-28-0x0000000000770000-0x000000000078A000-memory.dmp

Filesize
104KB

Download
memory/4940-42-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-56-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-58-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-34-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-36-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-38-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-44-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-46-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-48-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-52-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/4940-55-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download